Now, here’s the thing that surprises most folks.

Even if your API is hosted on a subdomain, e.g. https://api.example.com, the browser still sees it as a cross-origin request from https://example.com.

Moving the API to https://example.com/api will eliminate the need for preflight requests altogether.

Comments